Glossary
What is GDPR?
The GDPR (General Data Protection Regulation, known in Dutch as the AVG) is the European privacy law that governs how organisations may process personal data. It also applies when personal data is processed through an AI application.
GDPR explained
The GDPR rests on a few principles: you need a lawful basis to process personal data, you process no more than necessary, you secure the data properly and you keep it no longer than needed. Data subjects have rights, such as access and erasure, and in many cases a data breach must be reported to the supervisory authority within 72 hours.
If you work with a supplier that processes personal data on your behalf, such as a cloud platform or AI service, you sign a data processing agreement. If data goes to a country outside the European Economic Area, additional safeguards are required. For AI applications with a high privacy risk, a DPIA (data protection impact assessment) may be mandatory.
With AI on business data, the key question is which data goes to the AI model. If the model only sees table and column names and no rows of customer or employee data, the privacy risk of that step is much smaller than pasting entire exports into a chatbot.
Example
An employee at Acme Groothandel wants to know which customers have not ordered for three months. If he pastes the customer list into a free chatbot, he shares personal data with a third party; if he has AI write a query that runs in the company's own data warehouse, the customer data stays there.
GDPR in ENABLE
ENABLE does not claim any GDPR certification. The AI in ENABLE receives only metadata and the question through the OpenAI API, never rows of data or passwords. The portal is hosted on Vercel in the Frankfurt region; where a customer's data warehouse is located depends on the customer.
FAQ
Frequently asked questions
Can you use personal data in AI tools under the GDPR?
Only with a valid lawful basis, for a clear purpose, with appropriate security, and with a data processing agreement if a supplier processes the data. The safest approach is not to send personal data to an AI model at all when it is not needed.
What is the difference between the GDPR and the AVG?
There is no difference: AVG is the Dutch name and GDPR the English name for the same European regulation. The Dutch supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).
When do you need a data processing agreement?
When another party processes personal data on your behalf, such as a cloud provider, a software platform or an AI service. The agreement sets out what the processor may do with the data and how it secures it.
Further reading
- ResourcesAI Act and GDPR for AI on business dataIf you use AI on business data in the EU, two sets of rules apply: the AI Act, which sets requirements for AI systems based on their risk, and the GDPR, which applies as soon as personal data is processed. For most internal analytics applications, the focus is mainly on AI literacy, transparency and the GDPR basics: a lawful basis, a data processing agreement, data minimisation and, where necessary, a DPIA. This article is a practical orientation, not legal advice.Read more
- SolutionSecure AI for business: private AI on your dataWhat private, secure AI really means, and how ENABLE limits what the AI sees of your data.Read more
- SolutionAI governance: control over data, AI and accessWho sees what, what the AI receives and who approves: practical AI and data governance.Read more
- PlatformPower BI row-level security and dashboard accessAccess profiles, Power BI row-level security, two-factor authentication and an audit log.Read more
Use AI on your own data. Securely, and without the headache.
In an online demo we show how ENABLE makes your data securely available and how you build on it: describing an app in the AI Builder, plain-language questions, dashboards and APIs. And how we set it up and manage it for you.